181 lines
8.0 KiB
JSON
181 lines
8.0 KiB
JSON
{
|
||
"Definition": [
|
||
{
|
||
"ID": "oval:org.altlinux.errata:def:20247064",
|
||
"Version": "oval:org.altlinux.errata:def:20247064",
|
||
"Class": "patch",
|
||
"Metadata": {
|
||
"Title": "ALT-PU-2024-7064: package `ghostscript` update to version 10.01.1-alt2",
|
||
"AffectedList": [
|
||
{
|
||
"Family": "unix",
|
||
"Platforms": [
|
||
"ALT Linux branch c10f2"
|
||
]
|
||
}
|
||
],
|
||
"References": [
|
||
{
|
||
"RefID": "ALT-PU-2024-7064",
|
||
"RefURL": "https://errata.altlinux.org/ALT-PU-2024-7064",
|
||
"Source": "ALTPU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2022-00147",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2022-00147",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2023-02055",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2023-02055",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-3781",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-3781",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-45949",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-45949",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2023-28879",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-28879",
|
||
"Source": "CVE"
|
||
}
|
||
],
|
||
"Description": "This update upgrades ghostscript to version 10.01.1-alt2. \nSecurity Fix(es):\n\n * BDU:2022-00147: Уязвимость реализации функции sampled_data_finish() набора программного обеспечения для обработки, преобразования и генерации документов Ghostscript, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2023-02055: Уязвимость набора программного обеспечения для обработки, преобразования и генерации документов Ghostscript, связанная с записью за границами буфера в памяти, позволяющая нарушителю выполнить произвольный код\n\n * CVE-2021-3781: A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.\n\n * CVE-2021-45949: Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp).\n\n * CVE-2023-28879: In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then tries to write an escaped character, two bytes are written.\n\n * #46986: Артефакты генерации postscript, отсутствие текста на тестовой странице CUPS",
|
||
"Advisory": {
|
||
"From": "errata.altlinux.org",
|
||
"Severity": "Critical",
|
||
"Rights": "Copyright 2024 BaseALT Ltd.",
|
||
"Issued": {
|
||
"Date": "2024-04-27"
|
||
},
|
||
"Updated": {
|
||
"Date": "2024-04-27"
|
||
},
|
||
"BDUs": [
|
||
{
|
||
"ID": "BDU:2022-00147",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:N/I:N/A:C",
|
||
"CVSS3": "AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-787",
|
||
"Href": "https://bdu.fstec.ru/vul/2022-00147",
|
||
"Impact": "Low",
|
||
"Public": "20210526"
|
||
},
|
||
{
|
||
"ID": "BDU:2023-02055",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-787",
|
||
"Href": "https://bdu.fstec.ru/vul/2023-02055",
|
||
"Impact": "Critical",
|
||
"Public": "20230331"
|
||
}
|
||
],
|
||
"CVEs": [
|
||
{
|
||
"ID": "CVE-2021-3781",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
||
"CWE": "CWE-78",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-3781",
|
||
"Impact": "Critical",
|
||
"Public": "20220216"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-45949",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-787",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-45949",
|
||
"Impact": "Low",
|
||
"Public": "20220101"
|
||
},
|
||
{
|
||
"ID": "CVE-2023-28879",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-787",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-28879",
|
||
"Impact": "Critical",
|
||
"Public": "20230331"
|
||
}
|
||
],
|
||
"Bugzilla": [
|
||
{
|
||
"ID": "46986",
|
||
"Href": "https://bugzilla.altlinux.org/46986",
|
||
"Data": "Артефакты генерации postscript, отсутствие текста на тестовой странице CUPS"
|
||
}
|
||
],
|
||
"AffectedCPEs": {
|
||
"CPEs": [
|
||
"cpe:/o:alt:spworkstation:10",
|
||
"cpe:/o:alt:spserver:10"
|
||
]
|
||
}
|
||
}
|
||
},
|
||
"Criteria": {
|
||
"Operator": "AND",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:5001",
|
||
"Comment": "ALT Linux must be installed"
|
||
}
|
||
],
|
||
"Criterias": [
|
||
{
|
||
"Operator": "OR",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20247064001",
|
||
"Comment": "ghostscript is earlier than 0:10.01.1-alt2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20247064002",
|
||
"Comment": "ghostscript-classic is earlier than 0:10.01.1-alt2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20247064003",
|
||
"Comment": "ghostscript-common is earlier than 0:10.01.1-alt2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20247064004",
|
||
"Comment": "ghostscript-gtk is earlier than 0:10.01.1-alt2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20247064005",
|
||
"Comment": "ghostscript-module-X is earlier than 0:10.01.1-alt2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20247064006",
|
||
"Comment": "ghostscript-utils is earlier than 0:10.01.1-alt2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20247064007",
|
||
"Comment": "libgs is earlier than 0:10.01.1-alt2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20247064008",
|
||
"Comment": "libgs-devel is earlier than 0:10.01.1-alt2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20247064009",
|
||
"Comment": "libijs is earlier than 0:0.35_10.01.1-alt2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20247064010",
|
||
"Comment": "libijs-devel is earlier than 0:10.01.1-alt2"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]
|
||
} |